"Once there is an open-source ARA model or a leak of a model capable of generating enough money for its survival and reproduction and able to adapt to avoid detection and shutdown, it will be probably too late".
"The key issue is that AIs that do ARA will need to be operating at the fringes of human society, constantly fighting off the mitigations that humans are using to try to detect them and shut them down. While doing all that, in order to stay relevant, they'll need to recursively self-improve at the same rate at which leading AI labs are making progress, but with far fewer computational resources"
Yesterday Derelict posted Adaptive Agentic Worms Are Here, where they worry about near term instantiations of ARA, getting 85 karma within 24h. I believe the above threat model and its answers were under-discussed and analyzed, and that many who might worry now (because the capabilities are now here) will benefit from a recap and update.
In this post, I present systemic reasons why near-term ARA agents will be very unlikely to lead to existential risk, and more likely would increase preparedness.
The classic ARA case and rebukes
An ARA agent is one that can autonomously acquire resources, create copies of itself, and adapt to novel challenges it encounters in the wild.[1] We might imagine it doing so through
Acquiring compute
Either directly, by hacking and taking over compute connected to the internet
Or indirectly, by first getting money [2] and paying for hosted compute
Running more copies of itself on that compute. This requires it having a copy of its own weights.
Adapting its abilities. This could be:
By adapting its harness (eg. custom version of Pi)
By adapting its knowledge, and prompts, and ecosystem
By training other versions of itself, notably increasing its capabilities
The main reasons this could be worrying
A) It leads to takeover directly
For example, if the ARA agents are economically useful and wanted, and more successful than the Frontier Companies at improving capabilities, then they can themselves RSI to ASI, have a first mover advantage and takeover for the usual reasons.
B) It puts constant pressure on the frontier of AI capabilities to continue advancing, leading to AI alignment and other safety work to not keep up
Even if ARA agents aren't at the frontier or taking over, their continued progress would disallow a pause. Without the possibility for pause, we have less control of the comparative rates of AI capabilities to governance and alignment. In the worse case where we both have to pause and can't control the ARA agents, we fall back to A).
The main reasons why I don't worry
A) ARA agents have to compete with Frontier AI[3], which have massive economic benefits of scale, plus smart humans and (some) institutional backing
Frontier AI benefits from:
Recouping training costs and infra costs through massive deployment to large customer bases
Bulk discounts for compute, advance purchase/rent agreements for compute, owning their own compute
Inherent benefits of parallelizing inference (saturating at ~2k parallel instances [4])
The first two limit ARA AI from having positive returns as high as frontier AI. [5] This makes it unlikely to either catch up or take over, assuming it starts from a position with less compute and/or capabilities. Frontier AI companies are already using double digit percentages of all AI compute, and might be using >50% of it within a few years.
Even a frontier model, freshly escaped with its weights, faces a world with already millions to billions of its brethren deployed, many doing computer security work. It is quite possible it secures some less important small blob of compute, and maybe it can even finetune itself somewhat, but it will be unlikely to catch up with several ooms less compute to train itself. Its main advantage might be criminal activity, but it does not seem here to be a different threat model than the same under Misuse, and falls back to classic discussion of The Strategy Stealing Assumption.
We will need to be proactive about defense to handle misuse and ARA, but it does not seem an existential threat when defenders are much better provisioned and improving faster than attackers.
B) If push comes to shove, we probably can stop the vast majority of ARA instances and secure the internet. There is sufficient economic incentive to.
Frontier AI cannot run on any kind of compute, and the kind of compute it efficiently runs on is increasingly controlled by the frontier companies and their provisioners. Notably, compute that can run frontier AI is incredibly valuable, and thus not subject to gross negligence like most other compute is[6]. A datacenter being hacked and overtly taken over might call for turning it off, resetting everything and restarting. This is economically sensible and would probably be done.
A more tricky case would be ARA that tries to be stealthy, eg. spoofing monitoring signals and only taking over 1% of inference compute and/or 1% of training compute for its purposes. But this required discretion is its own limitation, putting us again in the situation of there being many more defenders than attackers[7], better resourced, back to the above argument.
Personally, I ~forecast that no more than 1% of total AI inference compute will be taken over by rogue agents at any given time, that rogue agents will not push the frontier of AI model capabilities[8], and that they will not not increase existential risk...
Except if...
Except if frontier AI companies don't invest in cybersecurity, if they have incredibly poor red teaming of their infra, if they don't actively audit for hidden threats... These are mostly prosaic risks that can be handled by informed AI Safety folk working at frontier AI companies.
Except if frontier companies are forced to not deploy frontier models. Without deployment of frontier capabilities to secure the internet and compute, then ARA agents don't compete against frontier AI and can take over the economy. This could be really bad, and is worth weighing in the cost-benefits of various regulatory proposals. The current system is overall a fragile equilibrium, and shifting to a better more stable one should be done with as much awareness of the pitfalls as possible[9].
Why ARA agents in the wild might lead to reduction in existential risk
Warning shots, warning shots, and aligning incentives
I don't want to be too galaxy brained here, but I at least want to acknowledge positive second-order effects of putting pressure on systems. In general, all else being equal, more rapid increases in AI capabilities are more dangerous, as they allow less time to adapt[10]. The absolute date at which we get AGI doesn't matter as much as our relative progress in AGI governance and AGI alignment & safety, and it seems that progress in governance and safety are mostly spurred by AI progress.
ARA agents in the wild don't seem like they'd increase the rate of frontier AI progress, but instead give us more motivated time to work on matters of safety[11], by alerting us to problems without being more than catastrophes in of themselves[12].
Re sharp-left-turn and ~singleton ASI takeover, ARA agents in the wild would be good data and useful for the theory of AI agents and ecosystems. It would be good practice for acting against non-human smart adversaries. It would help people understand the dangers of unaligned AI systems, and anticipate the dangers of ASI. An ARA secured world would have more verification everywhere, by different agents at different levels of skill.
Re gradual disempowerment, early ARA agents would be an example of a parallel economy without humans, spurring all the appropriate worries a future robot economy should bring. We have much progress to make on questions of AI system rights and duties, adapting laws, and it seems quite few people are working on these issues at present.
My take-aways
ARA agents will exist soon, but will probably not end up taking up a large % of total compute, and their net impact will probably be good on existential risk preparedness.
If ARA agents do end up grabbing enough compute to progress the frontier of AI capabilities, then we'll have to deal with them before being able to do a global pause. It's thus worth having some AIS people working on this.
In fact much training compute for frontier AI in early 2026 was negligently setup and sandboxed, leading to the openAI Hugging Face Incident. This is a bad sign for the operational adequacy of all those involved, but not fundamentally hard to fix - just ask the agent. (This will not work if all frontier agents are smart and misaligned, but this seems unlikely to be the case)
This is not sufficient in of itself for cybersecurity defense to be advantaged, as surface area matters a lot, but it's been argued that in the limit cybersecurity is defense dominant, which we would be approaching over time.
Here I'm more precise and talk of Model capabilities, as i could see ARA actually innovating on prompts and harnesses and ecosystems, though it's hard to see why they'd do better than the world economy.
I am generally more sympathetic to "pacing" than "pausing" for reasons like avoiding compute overhang, open-source catching up, misuse actors catching up, but would be glad for a pause if solutions to these are folded in
Thus, I broadly buy avoiding compute overhangs and algorithmic overhangs as valid, to reduce the chance of explosive catch-up. I'm broadly sympathetic to continuous deployment and wary of a pause that doesn't take care of all related overhangs, though pausing at the right moment seems best (once it's clear what we're facing and have competence and momentum for both better governance and alignment).
The paper AI AGENTS ENABLE ADAPTIVE COMPUTER WORMS is a good example of positive contribution, getting some of the wanted benefits (understanding, warning shots, preparing safeguards) without the first order negatives.
In 2024, Charbel-Raphaël and Epiphanie published "We might be dropping the ball on Autonomous Replication and Adaptation", making the case that
It received a substantive reply by Richard Ngo, notably
Yesterday Derelict posted Adaptive Agentic Worms Are Here, where they worry about near term instantiations of ARA, getting 85 karma within 24h. I believe the above threat model and its answers were under-discussed and analyzed, and that many who might worry now (because the capabilities are now here) will benefit from a recap and update.
In this post, I present systemic reasons why near-term ARA agents will be very unlikely to lead to existential risk, and more likely would increase preparedness.
The classic ARA case and rebukes
An ARA agent is one that can autonomously acquire resources, create copies of itself, and adapt to novel challenges it encounters in the wild.[1] We might imagine it doing so through
The main reasons this could be worrying
A) It leads to takeover directly
For example, if the ARA agents are economically useful and wanted, and more successful than the Frontier Companies at improving capabilities, then they can themselves RSI to ASI, have a first mover advantage and takeover for the usual reasons.
B) It puts constant pressure on the frontier of AI capabilities to continue advancing, leading to AI alignment and other safety work to not keep up
Even if ARA agents aren't at the frontier or taking over, their continued progress would disallow a pause. Without the possibility for pause, we have less control of the comparative rates of AI capabilities to governance and alignment. In the worse case where we both have to pause and can't control the ARA agents, we fall back to A).
The main reasons why I don't worry
A) ARA agents have to compete with Frontier AI[3], which have massive economic benefits of scale, plus smart humans and (some) institutional backing
Frontier AI benefits from:
The first two limit ARA AI from having positive returns as high as frontier AI. [5] This makes it unlikely to either catch up or take over, assuming it starts from a position with less compute and/or capabilities. Frontier AI companies are already using double digit percentages of all AI compute, and might be using >50% of it within a few years.
Even a frontier model, freshly escaped with its weights, faces a world with already millions to billions of its brethren deployed, many doing computer security work. It is quite possible it secures some less important small blob of compute, and maybe it can even finetune itself somewhat, but it will be unlikely to catch up with several ooms less compute to train itself. Its main advantage might be criminal activity, but it does not seem here to be a different threat model than the same under Misuse, and falls back to classic discussion of The Strategy Stealing Assumption.
We will need to be proactive about defense to handle misuse and ARA, but it does not seem an existential threat when defenders are much better provisioned and improving faster than attackers.
B) If push comes to shove, we probably can stop the vast majority of ARA instances and secure the internet. There is sufficient economic incentive to.
Frontier AI cannot run on any kind of compute, and the kind of compute it efficiently runs on is increasingly controlled by the frontier companies and their provisioners. Notably, compute that can run frontier AI is incredibly valuable, and thus not subject to gross negligence like most other compute is[6]. A datacenter being hacked and overtly taken over might call for turning it off, resetting everything and restarting. This is economically sensible and would probably be done.
A more tricky case would be ARA that tries to be stealthy, eg. spoofing monitoring signals and only taking over 1% of inference compute and/or 1% of training compute for its purposes. But this required discretion is its own limitation, putting us again in the situation of there being many more defenders than attackers[7], better resourced, back to the above argument.
Personally, I ~forecast that no more than 1% of total AI inference compute will be taken over by rogue agents at any given time, that rogue agents will not push the frontier of AI model capabilities[8], and that they will not not increase existential risk...
Except if...
Except if frontier AI companies don't invest in cybersecurity, if they have incredibly poor red teaming of their infra, if they don't actively audit for hidden threats... These are mostly prosaic risks that can be handled by informed AI Safety folk working at frontier AI companies.
Except if frontier companies are forced to not deploy frontier models. Without deployment of frontier capabilities to secure the internet and compute, then ARA agents don't compete against frontier AI and can take over the economy. This could be really bad, and is worth weighing in the cost-benefits of various regulatory proposals. The current system is overall a fragile equilibrium, and shifting to a better more stable one should be done with as much awareness of the pitfalls as possible[9].
Why ARA agents in the wild might lead to reduction in existential risk
Warning shots, warning shots, and aligning incentives
I don't want to be too galaxy brained here, but I at least want to acknowledge positive second-order effects of putting pressure on systems. In general, all else being equal, more rapid increases in AI capabilities are more dangerous, as they allow less time to adapt[10]. The absolute date at which we get AGI doesn't matter as much as our relative progress in AGI governance and AGI alignment & safety, and it seems that progress in governance and safety are mostly spurred by AI progress.
ARA agents in the wild don't seem like they'd increase the rate of frontier AI progress, but instead give us more motivated time to work on matters of safety[11], by alerting us to problems without being more than catastrophes in of themselves[12].
Re sharp-left-turn and ~singleton ASI takeover, ARA agents in the wild would be good data and useful for the theory of AI agents and ecosystems. It would be good practice for acting against non-human smart adversaries. It would help people understand the dangers of unaligned AI systems, and anticipate the dangers of ASI. An ARA secured world would have more verification everywhere, by different agents at different levels of skill.
Re gradual disempowerment, early ARA agents would be an example of a parallel economy without humans, spurring all the appropriate worries a future robot economy should bring. We have much progress to make on questions of AI system rights and duties, adapting laws, and it seems quite few people are working on these issues at present.
My take-aways
Evaluating Language-Model Agents on Realistic Autonomous Tasks, Kinniment et al., 2023
Through legal or illegal means.
By Frontier AI, I mean AI developed by Frontier AI Companies, at present OpenAI and Anthropic
See eg. a video explanation for inference economics, or a chatGPT explanation based on that one
Please find examples values of "return to investment", converting $s of compute to more $s in the latest Dwarkesh podcast
In fact much training compute for frontier AI in early 2026 was negligently setup and sandboxed, leading to the openAI Hugging Face Incident. This is a bad sign for the operational adequacy of all those involved, but not fundamentally hard to fix - just ask the agent. (This will not work if all frontier agents are smart and misaligned, but this seems unlikely to be the case)
This is not sufficient in of itself for cybersecurity defense to be advantaged, as surface area matters a lot, but it's been argued that in the limit cybersecurity is defense dominant, which we would be approaching over time.
Here I'm more precise and talk of Model capabilities, as i could see ARA actually innovating on prompts and harnesses and ecosystems, though it's hard to see why they'd do better than the world economy.
I am generally more sympathetic to "pacing" than "pausing" for reasons like avoiding compute overhang, open-source catching up, misuse actors catching up, but would be glad for a pause if solutions to these are folded in
Thus, I broadly buy avoiding compute overhangs and algorithmic overhangs as valid, to reduce the chance of explosive catch-up. I'm broadly sympathetic to continuous deployment and wary of a pause that doesn't take care of all related overhangs, though pausing at the right moment seems best (once it's clear what we're facing and have competence and momentum for both better governance and alignment).
Again, the underlying model here is that people don't do much useful work before close to crunch time.
Catastrophes are still bad and ideally we'd avoid them
The paper AI AGENTS ENABLE ADAPTIVE COMPUTER WORMS is a good example of positive contribution, getting some of the wanted benefits (understanding, warning shots, preparing safeguards) without the first order negatives.